6 ms·

I want the bill to pass for this reason. I want to see how the courts interpret it. Just how much pull should local jurisdictions be able to exert on a corporat

I want the bill to pass for this reason. I want to see how the courts interpret it. Just how much pull should local jurisdictions be able to exert on a corporation's business practices? Say the major vendors just decide to pull out of the NY market, yanking devices off of shelves. How exactly does NY think they can enforce the law?

sbuttgereit 11y ago
I'm not a lawyer or an expert on the commerce clause, etc. But is seems like these issues have passed muster before. Consider that California has stricter environmental regulations concerning the cars that are sold there than many other states. The manufacturers simply make cars that meet the California standard and sell them pretty much everywhere (at least I'm pretty sure that use the be the case, haven't kept up with it though). If that local regulation has passed any and all legal tests, then I would be surprised if New York couldn't act independently in this case. And I think the manufacturers would simply do something similar: you'd end up with compromised security on all devices that come under the law even in states where that law didn't exist.
- JoshTriplett 11y ago
  > The manufacturers simply make cars that meet the California standard and sell them pretty much everywhere (at least I'm pretty sure that use the be the case, haven't kept up with it though). Many manufacturers still distinguish cars with "California emissions".
- baddox 11y ago
  Another example: big name-brand beers have different alcohol percentages in different states.
- sathackr 11y ago
  I buy equipment all the time that is not legal for sale in California. But I don't go out of my way to do such. With the emissions argument, lower emissions is generally accepted as a positive feature, though some may dislike the reduced performance or increased cost associated with it in some instances. Backdoored encryption is not something generally accepted as a positive feature, and I suspect many people will specifically seek out non-backdoored devices if the law is passed and manufacturers start making devices for the lowest common denominator. But since this is a software feature, I see no reason why a single device couldn't serve both markets, with a fused bit somewhere permanently enabling the backdoor. But, as said previously ad nauseam, the law would stop criminals about as effectively as the anti-radar detector laws keeps radar detectors out of Virginia. The widespread use of instant-on radar and LIDAR has done far more to curb the widespread use of them, in all states, by simply making them ineffective.
  - sbuttgereit 11y ago
    Many people would seek out such devices... but many people can still be a small minority of your target market. If the economics makes sense to have two different builds they'll do it, if it doesn't then you'll get one size fits all. Also, consider how many people that buy these devices also use cloud services available for these devices where even fourth amendment protections are likely null/void. In some ways/shapes/forms it makes the device encryption backdoor already moot for many.
    - sathackr 11y ago
      Yes...I'm curious to see how 'things stored in the cloud' will eventually work out with the 4th/5th amendment protections. Seems most of the current law applies to them as electronic communications, but I think they are becoming more and more like a safe deposit box, which I think has fared a bit better. It's unfortunate that it will likely take a few guinea pigs with a lot of money and the right type of case to force the judicial system to work this out. Of course, the prudent criminal would encrypt anything, using non-backdoored encryption, before it left his/her control thus making LEO/Government access to their cloud storage ineffective.
cmurf 11y ago
Schadenfreude fan, huh? The courts will likely treat it the way they have wiretapping. That is, unless a skilled defense shows that unfunded and indefinitely key escrowing is impractical or unfair somehow, which is probably hard to do seeing as Apple used to offer a key escrow service (opt-in) on OS X's FileVault 2, and Microsoft offers one (opt-out after they have the key escrowed) still today. This is what China wants, so if Apple isn't going to stop selling in China on principled grounds, then why would they stop selling in NY or anywhere else that decides to go down this path? As for enforcement, every state has its own rules for merchants. NY State has the business license and if you don't follow their laws they can withdraw the license and now the company can't sell product in the state. The thing that irks me is this transparently targets average Joe User and below average crook. Because only those two groups will end up with either weaker encryption (breakable encryption, including backdoors) or keys being escrowed. Anyone who understands this, including the above average crook and far worse, will just get some other product that uses escrow-free strong encryption that isn't subject to that state or that country's laws.
- drdaeman 11y ago
  More likely "immediately worse present for a better future". It just seems that humans rarely learn unless they experience a painful failure (and sometimes a multiple ones are required) and get some reminders by the scars left. This, of course, doesn't work if worst is introduced gradually (it's how we got where we are) - only acute cases work. The idea is, governments would never cease their attempts just because there are some objections and counterpoints. But after a grand fuck-up they won't dare to try it - and if they do they'll be told "you want another New York, eh?" and that will work.
kec 11y ago
This sort of thing isn't exactly without precedent. Look at gun laws in CA: there are many types of firearms and firearm accessories which are legal in most of the US but cannot be sold or possessed in California. Gun manufacturers have responded over the years by either pulling out of the state entirely, or producing California compliant versions of their products.

sbuttgereit 11y ago

I'm not a lawyer or an expert on the commerce clause, etc. But is seems like these issues have passed muster before. Consider that California has stricter environmental regulations concerning the cars that are sold there than many other states. The manufacturers simply make cars that meet the California standard and sell them pretty much everywhere (at least I'm pretty sure that use the be the case, haven't kept up with it though). If that local regulation has passed any and all legal tests, then I would be surprised if New York couldn't act independently in this case. And I think the manufacturers would simply do something similar: you'd end up with compromised security on all devices that come under the law even in states where that law didn't exist.

JoshTriplett 11y ago
> The manufacturers simply make cars that meet the California standard and sell them pretty much everywhere (at least I'm pretty sure that use the be the case, haven't kept up with it though). Many manufacturers still distinguish cars with "California emissions".
baddox 11y ago
Another example: big name-brand beers have different alcohol percentages in different states.
sathackr 11y ago
I buy equipment all the time that is not legal for sale in California. But I don't go out of my way to do such. With the emissions argument, lower emissions is generally accepted as a positive feature, though some may dislike the reduced performance or increased cost associated with it in some instances. Backdoored encryption is not something generally accepted as a positive feature, and I suspect many people will specifically seek out non-backdoored devices if the law is passed and manufacturers start making devices for the lowest common denominator. But since this is a software feature, I see no reason why a single device couldn't serve both markets, with a fused bit somewhere permanently enabling the backdoor. But, as said previously ad nauseam, the law would stop criminals about as effectively as the anti-radar detector laws keeps radar detectors out of Virginia. The widespread use of instant-on radar and LIDAR has done far more to curb the widespread use of them, in all states, by simply making them ineffective.
- sbuttgereit 11y ago
  Many people would seek out such devices... but many people can still be a small minority of your target market. If the economics makes sense to have two different builds they'll do it, if it doesn't then you'll get one size fits all. Also, consider how many people that buy these devices also use cloud services available for these devices where even fourth amendment protections are likely null/void. In some ways/shapes/forms it makes the device encryption backdoor already moot for many.
  - sathackr 11y ago
    Yes...I'm curious to see how 'things stored in the cloud' will eventually work out with the 4th/5th amendment protections. Seems most of the current law applies to them as electronic communications, but I think they are becoming more and more like a safe deposit box, which I think has fared a bit better. It's unfortunate that it will likely take a few guinea pigs with a lot of money and the right type of case to force the judicial system to work this out. Of course, the prudent criminal would encrypt anything, using non-backdoored encryption, before it left his/her control thus making LEO/Government access to their cloud storage ineffective.

cmurf 11y ago

Schadenfreude fan, huh? The courts will likely treat it the way they have wiretapping. That is, unless a skilled defense shows that unfunded and indefinitely key escrowing is impractical or unfair somehow, which is probably hard to do seeing as Apple used to offer a key escrow service (opt-in) on OS X's FileVault 2, and Microsoft offers one (opt-out after they have the key escrowed) still today. This is what China wants, so if Apple isn't going to stop selling in China on principled grounds, then why would they stop selling in NY or anywhere else that decides to go down this path? As for enforcement, every state has its own rules for merchants. NY State has the business license and if you don't follow their laws they can withdraw the license and now the company can't sell product in the state. The thing that irks me is this transparently targets average Joe User and below average crook. Because only those two groups will end up with either weaker encryption (breakable encryption, including backdoors) or keys being escrowed. Anyone who understands this, including the above average crook and far worse, will just get some other product that uses escrow-free strong encryption that isn't subject to that state or that country's laws.

drdaeman 11y ago
More likely "immediately worse present for a better future". It just seems that humans rarely learn unless they experience a painful failure (and sometimes a multiple ones are required) and get some reminders by the scars left. This, of course, doesn't work if worst is introduced gradually (it's how we got where we are) - only acute cases work. The idea is, governments would never cease their attempts just because there are some objections and counterpoints. But after a grand fuck-up they won't dare to try it - and if they do they'll be told "you want another New York, eh?" and that will work.

kec 11y ago

This sort of thing isn't exactly without precedent. Look at gun laws in CA: there are many types of firearms and firearm accessories which are legal in most of the US but cannot be sold or possessed in California. Gun manufacturers have responded over the years by either pulling out of the state entirely, or producing California compliant versions of their products.